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REMARKS 

This responds to the Final Office Action dated June 1,-2010. Claims 1, 4, 7, 9-12, 15-18, 
34, 35, 37-39, 41, 43, 44, and 47-50 are amended, claims 6, 8, and 45 are canceled, and no 
claims are added. As a result, claims 1-5, 7-39, 41, 43, 44, and 46-50 are now pending in this 
application. 



Claim Objections 

Claim 4 is objected to due to informalities. In particular, the Examiner objected to claim 
4 because it recited "the method of claim T." 1 Applicants have amended claim 1 to recite the 
method of "claim 1." As a result, Applicants request reconsideration and withdrawal of the 
objection to claim 4. 



The Re jection o f Claims Under § 103 

Claims 1-5, 8-20, 32, 38, 41 and 43-50 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Publication No. 2003/01 10274 to Pazi et al. (hereinafter "Pazi") in view 
of Mackay (comp.os.ms-windows.networking.tcp-ip. "Can my ISP say ifi'm using a proxy?" 
2/16/2002. pgs. 1 -4; hereinafter "Mackay"). 

Regarding Claims 1-5, 8-20, 32, 38, 41 and 43-50 

Claim 1 has been amended to recite: 

A method of determining whether a potential relay device is a 
relay device, the method comprising: 

receiving a communication from the potential relay device, 
the communication comprising a first information element and a 



1 The Office Action p. 5, para. 7. 
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second information element, wherein the potential relay device is 
an original source of said second information element; 

identifying a feature of an original source of said first 
information element; 

identifying a feature of the potential relay device; and 

determining, using a relay detection system implemented at 
least in part in hardware, that the feature of the original source of 
said first information element and the feature of the potential 
relay device are features unlikely to relate to a single device, said 
determining being indicative that the potential relay device is a 
relay device. 

Support for the amendments may be found in at least, for example, previously presented claims 6 
and 8. 

Applicants submit that Pazi and Mackay, singularly or in combination, do not teach or 
suggest at least the limitations of "identifying a feature of an original source of said first 
information element," "identifying a feature of the potential relay device," and "determining . . . 
that the feature of the original source of said first information element and the feature of the 
potential relay device are features unlikely to relate to a single device." 

Pazi merely discusses a network guard system that "screens the number of hops traversed 
by incoming packets in order to assess which packets constitute legitimate network traffic, and 
which are spoofed." 2 It does this by comparing a Time-To-Live (TTL) value in the header of 
each received packet with a stored record of the expected TTL value for the source address of the 
received packet. 3 "If the TTL value of an incoming packet matches the stored TTL value or 
number of hops for the source address of the packet ... the guard system recognizes the packet 
as likely to be legitimate." 4 If the TTL value of the packet does not match the stored value, this 
indicates spoofing or packets containing bogus IP source addresses 5 and "the guard treats the 
packet as suspect, and either discards it or allows it to pass with a priority that is reduced." 6 



2 Pazi at para. [0007]. 

3 See Pazi at para. [0007]. 

4 Pazi at para. [0007]. 

5 See Pazi at para. [0004]. 

6 Pazi at para. [0008]. 
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In the Office Action, the Examiner merely lists paragraphs [0047] and [0055] and states 
that these paragraphs show "discovering said feature of an original source of said first 
information element" and "discovering said feature of the potential relay device." 7 Applicants 
respectfully disagree. Paragraph [0047] and [0055] of Pazi discusses TTL entries stored in 
database 30, however, the stored TTL entries are "the expected TTL value (or number of hops) 
of packets." 8 Therefore a TTL entry is an expected characteristic of a packet and not a "feature 
of an original source" of a first information element or a "feature of the potential relay 
device."" As a result, Pazi does not show, disclose, or even hint at "identifying a feature of an 
original source of said first information element" or "identifying a feature of the potential relay 
device" as recited in amended claim 1. 

The Examiner also argues that Pazi shows "determining . . . that a feature of an original 
source of said first information element and a feature of the potential device are features unlikely 
to relate to a single device." 9 More specifically, the Examiner argues that "If the claimed source 
address is detected by Pazi's disclosure as being 'bogus' then there are two devices; the 
legitimate device and the bogus device" 10 The Examiner goes on to further explain that, in his 
view, "Pazi's teachings of detecting two devices meets the limitations of Applicant's claim 
language which recites determining features 'unlikely to relate to a single device'." 11 

Applicants respectfully submit that the Examiner has overlooked a portion of what is 
recited in the claim. For example, the Examiner ignores "determining . . . that the feature of the 
original source of said first information element and the feature of the potential relay device 
are features unlikely to relate to a single device" as recited in claim 1 . Pazi does not disclose 
these limitations. Instead, as discussed above, Pazi at most discusses determining if the TTL 
value of an incoming packet matches a stored TTL value. This TTL value of an incoming 
packet is a "field in the IP packet header, which is supposed to indicate the number of hops that a 
packet has traversed through the network since leaving its source." 12 Thus, the TTL value of the 

7 The Office Action p. 7, line 22 - p. 8, line 2. 

8 Pazi para. [0007]. 

9 The Office Action p. 6, lines 13-15. 

10 The Office Action p. 2, lines 17-19 

11 The Office Action p. 2, line 21 - p. 3, line 4. 

12 Pazi para. [0004]. 
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incoming packet is a characteristic of the packet and not a feature of "the original source of said 
first information element" or the "potential relay device" as recited in claim 1. Similarly, the 
stored TTL value discussed in Pazi is "the expected TTL value (or number of hops) of packets" 13 
and not a feature of "the original source of said first information element" or the "potential relay 
device" as recited in claim 1. 

The Examiner does not rely on Mackay to show or disclose any of the limitations 
discussed above. Further Applicants submit that, in fact, Mackay does not show or disclose any 
of the limitations discussed above. Mackay simply discusses methods an internet service 
provider (ISP) can use to detect if a user is using proxy services. 14 For example, a TTL value 
may be accessed and if it is "less than the value you are expecting, then the user is behind a NAT 
gateway," headers may be inspected for proxy traffic, or signatures of common NAT routers and 
proxy servers may be looked for. 15 

Furthermore, in the Office Action, the Examiner argues that Applicants acknowledge that 
"Pazi shows determining that a packet is 'not from the same source'." 16 Applicants respectfully 
disagree. The Examiner seems to come to this conclusion based on Applicants' arguments filed 
March 10, 2010, 17 which states: 

In Pazi, if the TTL value of the packet does not match the stored 
value, this indicates spoofing or packets containing bogus IP 
source addresses™ and "the guard treats the packet as suspect, and 
either discards it or allows it to pass with a priority that is 
reduced." 19 A TTL value of a spoofed packet is not from the same 
source as the stored TTL value. 

A TTL value of a spoofed packet not being from the same source is not the same as a 
packet not from the same source. Applicants also did not acknowledge that Pazi shows this. 
Instead, Applicants were attempting to express that, as discussed above, Pazi discusses 
determining if the TTL value of an incoming packet matches a stored TTL value. This source of 



13 Pazi para. [0007]. 

14 Mackay at p. 2. 

15 Id. 

16 The Office Action p. 2, lines 19-20, line 4; see also p. 4, lines 7-8. 

17 The Office Action p. 2, lines 3-20. 

18 See Pazi at para. [0004]. 

19 Pazi at para. [0008]. 
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the TTL value is the incoming packet. The source of the stored TTL value is not the incoming 
packet, but instead, a database such as database 30 in Figure 1 of Pazi. 

For the reasons above, both Pazi and Mackay, singularly or in combination, do not teach 
or suggest all the limitations in amended claim 1. Furthermore, independent claims 38, 41, 43, 
and 50 recite limitations similar to those above and therefore are patentable for the same reasons 
as those presented above. Claims 2-5, 9-20, 32, and 44-49 all depend, either directly or 
indirectly, from claims 1 and 43 and include all limitations therein and therefore are also 
patentable for the same reasons as the claim from which they depend. Further, these dependent 
claims may each be patentable for its own limitations. Since Applicants have shown that not all 
the claimed elements were known by Pazi and Mackay, Applicants respectfully submit that 
claims 1-5, 9-20, 32, and 43-50 are patentable and request the Examiner to reconsider and 
withdraw the rejection under 35 U.S.C. §103. 



Regarding Claims 6-7 and 33 

Claims 6-7 and 33 were rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Pazi in view of Mackay as applied to claim 1 above, and further in view of Reed ("Applying the 
OSI Seven Layer Network Model to Information Security" November 21, 2003, hereinafter; 
"Reed"). 

Claims 6-7 and 33 depend, either directly or indirectly, from independent claim 1 and 
include all limitations therein. As discussed above, the combination of Pazi and Mackay does 
not disclose all elements claimed. The addition of Reed does not cure these defects. As a result, 
claims 6-7 and 33 are also patentable and request the Examiner to reconsider and withdraw the 
rejection under 35 U.S.C. §103. Further, these dependent claims may each be patentable for its 
own limitations. 



Pazi, para. [0036] and Figure 1. 
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Regarding Claims 21-23 and 34 

Claims 21-23 and 34 were rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Pazi in view of Mackay as applied to claim 1 above, and further in view of Nilsen 
(alt.comp.lang.php "how to detect PROXY?" 12/24/2001. pgs. 1-2, hereinafter; "Nilsen"). 

Claims 21-23 depend, either directly or indirectly, from independent claim 1 and include 
all limitations therein. As discussed above, the combination of Pazi and Mackay does not 
disclose all elements claimed. The addition of Nilsen does not cure this defect. As a result, 
claims 21-23 are also patentable and Applicants respectfully request the Examiner to reconsider 
and withdraw the rejection under 35 U.S.C. §103. Further, these dependent claims may each be 
patentable for its own limitations. 

Independent claim 34 has been amended to include limitations similar to those discussed 
with respect to claim 1. As discussed above, the combination of Pazi and Mackay does not 
disclose at least these limitations. The addition of Nilsen does not cure these defects. As a 
result, claim 34 is also patentable and Applicants respectfully request the Examiner to reconsider 
and withdraw the rejection under 35 U.S.C. §103. 



Regarding Claims 24-31, 35-36 and 39 

Claims 24-31, 35-36 and 39 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Pazi in view of Mackay as applied to claim 1 above, and further in view of 
Daude (U.S. Patent No. 6,892,235). 

Claims 24-31 depend, either directly or indirectly, from independent claim 1 and include 
all limitations therein. As discussed above, the combination of Pazi and Mackay does not 
disclose all elements claimed. The addition of Daude does not cure this defect. As a result, 
claims 24-3 1 are also patentable and Applicants respectfully request the Examiner to reconsider 
and withdraw the rejection under 35 U.S.C. §103. Further, these dependent claim's may each be 
patentable for its own limitations. 
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Independent claim 35 has been amended to limitations similar to those discussed with 
respect to claim 1. As discussed above, the combination of Pazi and Mackay does not teach or 
suggest at least this limitation. The addition of Daude does not cure these defects. As a result, 
claim 35 is also patentable and Applicants respectfully request the Examiner to reconsider and 
withdraw the rejection under 35 U.S.C. §103. Claim 36 depends from independent claim 35 and 
includes all limitations therein. As a result, claim 36 is also patentable and Applicants 
respectfully request the Examiner to reconsider and withdraw the rejection under 35 U.S.C. 
§103. Further, claim 36 may each be patentable for its own limitations. 



Regarding Claims 37 

Claim 37 was rejected under 35 U.S.C. § 103(a) as being unpatentable over Pazi et al. 
(U.S. Publication No. 2003/0070096, hereinafter "Pazi2") in view of Mackay. 

Independent claim 37 has been amended to limitations similar to those discussed with 
respect to claim 1. As discussed above, the combination of Pazi and Mackay does not teach or 
suggest at least this limitation. The addition of Pazi2 does not cure these defects. As a result, 
claim 37 is also patentable and Applicants respectfully request the Examiner to reconsider and 
withdraw the rejection under 35 U.S.C. §103. 



AMENDMENT AND RESPONSE UNDER 37 C.F.R. § 1.116 - EXPEDITED PROCEDURE 

Serial Number: 10/585,5 17 
Filing Date: July 10, 2006 

Title: DETECTING RELAYED COMMUNICATIONS 



Page 22 

Dkt: 2043.56IUS1 



CONCLUSION 



Applicants respectfully submit that the claims are in condition for allowance, and 
notification to that effect is earnestly requested. The Examiner is invited to telephone the 
undersigned at (408) 406-4855 to facilitate prosecution of this application. 

If necessary, please charge any additional fees or deficiencies, or credit any 
overpayments to Deposit Account No. 19-0743. 



CERTIFICATE UNDER 37 CFR 1.8 : The undersigned hereby certifies that this correspondence is being filed using the 
USPTO's electronic filing system EFS-Web, and is addressed to: Mail Stop AF, Commissioner for Patents, P.O. Box 1450, 
Alexandria, VA 22313-1450 on this 1 st day of September, 2010. 
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